# Privacy Policy

**IOConnex LLC**, an Arizona limited liability company ("IOConnex," "we," "us," "our")
Effective date: September 23, 2026 · Last updated: September 27, 2026


## 1. Scope

This policy describes how we collect, use, disclose, and safeguard information when you use our API services, including our MCP servers (the "Services"). Our Services are APIs used primarily by software and AI agents; we collect the minimum data necessary to operate them.

## 2. Information We Collect

**a) Information you provide:** support correspondence and any information you send us when you contact us.

**b) Information collected automatically (request metadata):** IP address, request path, user-agent, timestamp, and usage counters — collected for rate limiting, metering, abuse prevention, security, and operational logs.

**c) Payment information:**
- *x402 micropayments:* payer wallet address, payment amount, and authorization signatures. These are recorded on the public Base blockchain and are visible to anyone. To verify and settle payments, the payment payload is transmitted to our x402 facilitator (Coinbase Developer Platform). We log transaction metadata (transaction hash, payer address, amount) server-side and temporarily hold payment signatures in server memory (up to 5 minutes) to prevent replay attacks.
- *Stripe subscriptions:* payments are processed by Stripe, Inc. We never receive or store full card numbers. We store your Stripe customer identifier, the email address from your Checkout session, and the SHA-256 hash of your subscriber key.

**d) Upstream processing:** to fulfill requests, query contents are transmitted to upstream data providers (e.g., our search index provider). We do not use your API inputs to train machine-learning models.

We do not require user accounts, do not use advertising trackers or third-party analytics cookies, and do not collect names, addresses, or other profile data unless you provide them.

## 3. How We Use Information

- To operate, meter, bill for, and support the Services;
- To prevent abuse, fraud, attacks, and overload, and to enforce our Terms;
- To respond to support requests and legal process;
- To comply with legal, tax, and accounting obligations.

Legal bases for processing (where GDPR applies): performance of a contract, our legitimate interests in operating and securing the Services, and compliance with legal obligations.

## 4. How We Disclose Information

We disclose information only as follows:

- **Service providers (subprocessors):** Stripe, Inc. (payments); Coinbase Developer Platform (x402 facilitation); Render (hosting); Cloudflare (DNS/CDN); and upstream data providers (to fulfill search/fetch/convert requests). Each processes data only as needed to provide its service.
- **Legal compliance:** when required by law, subpoena, or court order, or to protect our rights, users, or the public.
- **Business transfers:** in connection with a merger, acquisition, or sale of assets, subject to this policy's protections.
- **With your consent** or at your direction.

**We do not sell your personal information, and we do not share it for cross-context behavioral advertising** (as those terms are defined under the CCPA/CPRA). We do not share request data with advertisers or data brokers.

## 5. International Data Transfers

The Services are operated in the United States. If you access the Services from outside the US, you consent to the transfer, storage, and processing of your information in the US, where data-protection laws may differ from those in your jurisdiction.

## 6. Data Retention

- Operational and security logs: retained up to 12 months, then deleted or anonymized (our hosting provider's own retention also applies).
- Payment and tax records: retained as required by law, generally 7 years.
- Support correspondence: retained as long as needed to resolve the matter.

Blockchain records of x402 payments are public and permanent; they cannot be deleted by us.

## 7. Security

We use industry-standard safeguards: TLS encryption in transit, hashed subscriber credentials, minimal data collection, and access controls. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.

## 8. Your Privacy Rights

Depending on your jurisdiction (including California under the CCPA/CPRA, and the EEA/UK under the GDPR), you may have the right to: know what personal information we collect and why; access or receive a portable copy of it; correct inaccuracies; request deletion; and opt out of any sale or sharing of personal information (we do not sell or share, as defined by law).

To exercise these rights, email hello@ioconnex.dev. We will verify your request (e.g., via your subscriber key or Stripe customer identifier) and respond within the time required by law (generally 30–45 days). You may use an authorized agent with your written permission. We will not discriminate against you for exercising your rights. Note: deletion requests cannot remove public blockchain records.

## 9. Children

The Services are not directed to children under 13, and we do not knowingly collect their information. Our Terms require users to be at least 18.

## 10. Changes to This Policy

We may update this policy; material changes will be posted with a revised effective date and, where practicable, reasonable advance notice. Continued use after the effective date constitutes acceptance.

## 11. Contact

IOConnex LLC — Privacy inquiries: hello@ioconnex.dev